Identifying Key Cyber-Physical Terrain (Extended Version)

0.52 MB·

by  Brian Thompson

Identifying Key Cyber-Physical Terrain (Extended Version)
BrianThompson
TheMITRECorporation&U.S.ArmyResearchLab
7515ColshireDr.
McLean,VA22102
[email protected]
7
RichardHarang
1
0 InvinceaInc. &U.S.ArmyResearchLab
2 3975UniversityDr. #460

n Fairfax,VA22030
a
[email protected]
J

5
2 Friday27th January,2017

]
R
Abstract
C
. The high mobility of Army tactical networks, combined with their close proximity to hostile actors, elevates
s
the risks associated with short-range network attacks. The connectivity model for such short range connections
c
[ underactiveoperationsisextremelyfluid,andhighlydependentuponthephysicalspacewithinwhichtheelement

isoperating,aswellasthepatternsofmovementwithinthatspace. Tohandlethesedependencies,weintroducethe
1
notion of “key cyber-physical terrain”: locations within an area of operations that allow for effective control over
v
thespreadofproximity-dependentmalwareinamobiletacticalnetwork,evenastheelementsofthatnetworkarein
1
constantmotionwithanunpredictablepatternofnode-to-nodeconnectivity. Weprovideananalysisofmovement
3
3 models and approximation strategies for finding such critical nodes, and demonstrate via simulation that we can
7 identifysuchkeycyber-physicalterrainquicklyandeffectively.
0
.
1 1 Introduction
0
7
1 1.1 Motivation
:
v
Armytacticalnetworksinthefieldfaceauniquesetofsecurityconsiderationsnotfoundineithermoreconventional
i
X wireless networks or fixed infrastructure networks. While much previous work in analyzing the spread of malware
r in networks (including tactical networks) focuses on the logical connectivity of the graph over time, these logical
a connectivity paths are often dominated by long-range tactical links which introduce some degree of stability to the
logicalconnectivitygraph. HoweverthecloseproximityofArmytacticalnetworkstoadversarialnetworksintroduces
newconsiderationsintheformofspatialpropertiesofthenetwork: whichunitsareincloseproximitytoeachother
andatwhattimes. Thisformofconnectivityisparticularlyrelevantinthecaseofattacksthatrestrictthemselvesto
short-range wireless communications – such as through 802.11 or Bluetooth network stacks – which may be more
difficulttodetectduetotheirfailuretocrossmoreconventionalsecurityboundariesorhigher-resourcenodescapable
offieldingmoresophisticatedintrusiondetectionsystems.
The short range of these attacks means that – at any given instant – the communications graph available to the
malware is effectively disconnected, and it is only the mobility of the infected components over time that brings
new victims into range and allows it to propagate. In addition, detection or remediation of such infections may
be prohibitively difficult to perform in the field, perhaps involving detailed scans, or simply complete reimaging
orreplacementofanypotentiallycompromiseddevices,andsoonlycarriedoutatparticularlocations. Furthermore,
whilestandarddefensivemeasuresareeffectiveagainstknownmalwareandminorvariants,novel(“zero-day”)attacks
maybespecificallydevelopedforanddeployedagainstmilitarymobilenetworks.Thismalwaremaynotbedetectable,
1
and so understanding how to bound the potential impact of such malware, even when not specifically alerted to its
presence,isanimportantproblem.
Thenotionofmobilityovertime,combinedwiththeregularitiesindeploymentandmobilityofindividualArmy
components(suchasregularpatrols, movementalongroadsandhighways, andsoforth), andlimitedcapabilitiesto
detect or remediate such attacks, leads us to our notion of key cyber-physical terrain: critical points in the spatio-
temporal graph which can be exploited to limit the spread of short-range malware. Identifying such critical points
turns out to be surprisingly difficult in practice and so we explore several methods – from simple graph-theoretic
approachestodynamicalsystemapproximationstofullsimulation–thatcapturedifferentaspectsofthisproblem.
1.2 RelatedWork
Mathematical models of virus spread were first developed in the context of biological epidemics, primarily com-
partmentalmodelswhichassumehomogeneousinteractionrateswithinthepopulation, suchasthewell-knownSIR
(Susceptible-Infected-Recovered)model[7]anditsnumerousvariants.KephartandWhiteapplycompartmentalmod-
elstostudythedynamicsofmalwarespreadincybernetworks,additionallyusingsimulationtoevaluateunderwhich
assumptions the compartmental models are most accurate [6]. They consider several network topologies, such as
Erdos-Renyirandomgraphs,connectedregulargraphs,andsparsegraphswithahighclusteringcoefficient. Inallof
thesetopologicalmodelstheystudythenumberofinfectednodesinthepopulationovertimeandhowvariousfactors
affectconvergencetoasteadystate, findingthatinmanycasesthereexistsasharpepidemicthreshold. Othershave
extended such models to additional network topologies and contexts. For example, Boguna et al. [1] and Dezso˝ et
al.[3]focusonepidemicmodelsforpower-lawnetworks.
Marveletal.proposeaframeworktoevaluatecyberagility,buttheyfocusonscenariosinwhicheitheraspecific
vulnerability or infected node is known to exist, and attempt to optimize the patching and isolation process in the
networktopreservenetworkintegrityundervariousconstraintsincludingconnectivityandpowerusage[8]. Huberet
al.examineasimilarproblemusingadecisionsupportsysteminasmallnetworkof10activenodes[5]. Bothcases
assumemalwarewithcompleteaccesstothenetworkstack,whichbothallowslonger-distancepropagationthanthe
localmodelweconsider,andsignificantlyincreasestheprobabilitythattheadversarywillbedetected.
Mickens et al. study device-to-device spreading of malicious software in mobile ad-hoc networks (MANETs)
by explicitly modeling node mobility [9, 10]. Valler et al. develop a framework for analyzing malware spread in
MANETs under the SIS (Susceptible-Infected-Susceptible) model [13]. Su et al. perform simulations using trace
data drawn from real-life sampling of over 10,000 devices in a commuter train station to examine the propagation
dynamics of Bluetooth worms, showing that Bluetooth worms can infect a large population of vulnerable devices
relativelyquicklyinanurbanenvironment[11]. Ontheotherhand,Wangetal.modelthespreadofmalwareacross
networksofmobilephoneusersandobservethatBluetooth-basedmalwarespreadsslowlyduetotheshortrangeof
Bluetoothandthereforetherelativelylowcontactratebetweendevices[14].Thishighlightsthefactthatthedynamics
of malware spread in MANETs varies significantly based on the properties of the underlying movement patterns.
In particular, the highly-structured movement often seen in military contexts differentiates mobile tactical networks
from civil MANETs and impacts the propagation of malware in such settings [12]. In this work, we explore how
toleveragethestructuredmobilitypatternsofmobiletacticalnetworkstodevelopmoreeffectivedefensestrategies,
modelingtacticaloperationsoverageographicalregioncontainingtownsconnectedbyaroadnetwork,andproposing
computationalmethodstodeterminehowtobestallocatedefensiveresources.
1.3 ContributionsandOutline
Themaincontributionsofthisworkare:
• Modelandproblemformulationhighlightingtheneedforimprovedsecurityincyber-physicaltacticaloperations
• Threecomputationalapproachesfordecidingwheretoplaceremediationstationstobestcontrolthespreadof
malware
• Evaluationandcomparisonofthethreeapproaches
InSection2wedescribeourtacticalmodelandproposethreecomputationalapproachestodeterminetheoptimal
defenderstrategy. InSection3weperformexperimentstoevaluateandcomparetheeffectivenessoftheapproaches.
WeconcludewithsomediscussionanddirectionsforfutureworkinSection4.
2 Methods
2.1 ModelandProblemStatement
We consider a scenario in which tactical units of soldiers are deployed to towns in the same geographical region,
connectedbyaroadnetwork. Astimegoeson, aunitmaygetredeployedtoanothertown, atwhichpointittravels
fromitscurrenttowntothedesignatedtownthroughtheroadnetwork.
Eachsoldierisequippedwithamobiledevicethatfacilitatesshort-rangewirelesscommunication,suchasBlue-
tooth,onthebattlefield. Eachdeviceregularlyscanstheenvironmentfornearbyfriendlydevices. Whentwofriendly
devicescomewithincommunicationrange,theyautomaticallyconnect,enablingdatatransmission.
Enemyforcesmayattempttoinfiltratethealliedcybernetworkbyinfectingallieddeviceswithself-propagating
malware, for example by infecting the device of a captured soldier or by deploying cyber hacking teams that can
infectallieddevicesremotely. Whenasoldierwithaninfecteddevicecomeswithinrangeofafriendlysoldierwith
an uninfected device, the malware spreads. The malware could, for example, give the enemy access to sensitive
information,orthecapabilitytocorruptdataoninfecteddevices.
Toprotecttheircybernetworkfromattack,alliedforcesmayestablishsometownsasremediationzones;anyallied
unitsenteringsuchtownspassthroughacheckpointwheretheirdevicesarereset, replaced, orotherwisecleanedof
malware. However,resourcesarelimited,sojudiciouslychoosinglocationsatwhichtoestablishremediationzonesis
critical.
Objective:Givenknowledgeoftheroadnetwork,situationalawarenessofthelocationofenemystrongholds,and
anassessmentofremediationresourcescurrentlyavailable,determinetheoptimalplacementofremediationzonesto
minimizethefractionofdevicesthatareinfectedwithmalware.
Below,weexplorethreeapproachestoaddressingthisproblem:centralityanalysis,dynamicalsystems,andagent-
basedmodeling.
2.2 CentralityAnalysis
In the centrality-based approach, we represent the road network as a graph and use network centrality analysis to
identifythetownsatwhichtoestablishremediationzones. Theintuitionisthatthemostcentralverticesarethemost
important,eithervisitedmostfrequentlyorlocatedatimportantjunctures.LetGbeanundirectedgraphwithvertexset
V(G)={v ,...,v }correspondingtothetownsandedgesetE(G)⊆(cid:0)V(cid:1)correspondingtotheroads. Acentrality
1 n 2
metricassignsweightstotheverticesinagraphbasedonhowcentraltheyare. Foragivencentralitymetricµ,welet
µ :V(G)→RdenotethemappingfromtheverticesofGtotheircorrespondingvaluesunderthecentralitymetric.
G
Weconsidertwocommoncentralitymetrics:
• PageRankcentrality[2]-favorsverticeswithconnectionstootherwell-connectedvertices
• Betweennesscentrality[4]-favorsverticesthatlieonshortestpathsbetweenmanyotherpairsofvertices
Thechoiceofmetricmaybecontext-specific.Forexample,PageRankcentralityhasanaturalcorrespondencewiththe
frequencyofverticesbeingvisitedunderamobilitymodelwhereunitsperformarandomwalkontheroadnetwork,
i.e. choosing the next town to visit uniformly at random from the set of neighboring towns. On the other hand,
Betweenness centrality naturally corresponds with vertex frequency under a random waypoint mobility model, i.e.
whereunitschooseatownuniformlyatrandomfromthesetofalltownsandthentraverseashortestpathtogetthere.
Ifthereareonlyresourcesforasingleremediationzone,centralitymetricsofferastraight-forwardwaytochoose
wheretoplaceit: atthetowncorrespondingtothevertexwiththehighestcentralityscore. Ifthereareresourcesfor
k > 1remediationzones,however,thenaturalsolutionofchoosingthetownscorrespondingtotheverticeswiththe
khighestcentralityvaluesmaynotbeaverygoodstrategy. Forexample,considerthegraphinFigure1withk = 2.
Vertices D and E have the top two centrality scores for PageRank and Betweenness centrality, yet a better strategy
would likely be to choose one vertex in {A,B,C} and one vertex in {D,E} because that would cut the graph into
twosimilarly-sizedsubgraphsbetweenwhichmalwarecouldnotpropagate.
Toaddressthisproblem,wepresentaniterativealgorithm,describedinAlgorithm1.Thealgorithmcomputescen-
tralityscores,deletesthevertexwiththehighestscore,andrepeatsuntilkverticeshavebeendeleted. Theremediation
zonesshouldbeplacedatthetownscorrespondingtothedeletedvertices.
However,therearestilltimeswhenthisdoesnotproducethedesiredbehavior. Forexample,considerthegraphin
Figure2withk =2. VerticesAandDaretiedforthetopcentralityscoreforPageRankandBetweennesscentrality.
Figure1: Anexampleroadnetwork. TownsDandEmaybethemostcentralaccordingtomanymetrics,butthebest
pairoftownswouldlikelyincludeoneof{A,B,C}andoneof{D,E}.
Algorithm1Centrality-basedalgorithm
Input: AgraphG,acentralitymetricµ,andanintegerk ≥1.
Output: AsubsetV∗ ⊆V(G)ofsizekcorrespondingtothetownsatwhichtoestablishremediationzones.
R
InitializeG :=G
0
For1≤i≤k:
• Computeµ =µ
i−1 Gi−1
• Setv := max µ (v)
i v∈V(Gi−1) Gi−1
• SetG :=G −v
i i−1 i
ReturnV∗ ={v :1≤i≤k}
R i
Figure 2: An example road network. The iterative centrality-based algorithm would remove A and D under many
metrics,butthebestpairoftownswouldlikelyincludeBorC.
Figure3:Anexampleroadnetwork. TownAmaybethemostcentralaccordingtomanymetrics,butthebestlocation
foraremediationzoneisattownB.
Afteroneofthemisdeleted,theotherstillhasthehighestscoreontheremaininggraph. However,abetterstrategy
wouldlikelybetochooseverticesBandC forthesamereasonasabove.
Furthermore, there is no clear way of incorporating situational awareness of which towns are controlled by the
Figure4: Markovchainforsimpleexamplescenario
enemyandthereforemostlikelythatallieddeviceswillgetinfectedwithmalware. Forexample,considerthegraphin
Figure3withk =1. VertexAhasthehighestcentralityscoreforbothmetrics,butthebeststrategywouldobviously
betochoosevertexB.Thisisadrawbackofanycentrality-basedalgorithm,sincetheyarebasedsolelyonthenetwork
topologyandarenotsensitivetothelocationsofenemystrongholds.
Nextweconsideranapproachfromthefieldofdynamicalsystemsthataddressestheseproblems.
2.3 DynamicalSystems
Inthedynamicalsystemsapproach, webeginbymodelingthemovementofeachunitasacontinuous-timeMarkov
chain, where states correspond to towns and roads, and transitions correspond to changes in location in response to
newtacticalorders. Whendeployedatatown,aunitstaysthereforsomedeploymenttimeuntilitreceivesneworders
totraveltoaneighboringtown. Whenitreceivesthetravelorder,ittransitionstotheroadbetweenthetwotowns,and
remainsthereforthedurationofthetraveltime,whichmaydependonthedistance,terrain,weatherconditions,etc.
Let S denote the state corresponding to town i, and let S denote the state corresponding to traversing a road
i i,j
fromtownitotownj. Wedefinetheaveragewaittimew forstateS tobeequaltotheaveragedeploymenttimefor
i i
towni. Wedefinetheaveragewaittimew forstateS tobeequaltotheaveragetraveltimefromtownitotownj.
i,j i,j
There are two types of transitions: from a state S to a state S , corresponding to departure from town i along
i i,j
a road to town j; and from a state S to a state S , corresponding to arrival at town j along a road from town
i,j j
i. Assuming that units leaving a town have the same likelihood of traveling to each of the neighboring towns, the
transitionratesareasfollows:
1
(∀i,j :(v ,v )∈E(G)) T(S ,S ) =
i j i i,j w ·d
i i
1
(∀i,j :(v ,v )∈E(G)) T(S ,S ) =
i j i,j j w
i,j
TheMarkovchainforasimpleexamplescenarioisillustratedinFigure4.
Next, we describe the movement of all units collectively using a compartmental model corresponding to the
Markov chain described above, capturing the fraction of units in each state and the flows between them with a set
ofdifferentialequations. Theseequationscanthenbeusedtosolveforthefractionofunitsineachstateatequilib-
rium,indicatingwhichtownswillbemostfrequentlyvisited,whichcouldbegoodcandidatesforremediationzones.
AmoredetailedtechnicaldescriptionofthisapproachisprovidedinAppendixA.
However,thesameproblemsencounteredunderthecentrality-basedapproachabovestillremain: choosingaset
oftownsbasedoneachtown’sindividualvaluemaynotyieldthebestresultscollectively;andwehavenotleveraged
knowledgeofthelocationofenemystrongholds.
To address these problems, we consider a modified Markov model that splits each previous state into two dual
states, corresponding to whether the unit is clean or infected. We denote this by states SC, SI, SC , and SI . Let
i i i,j i,j
V denotethesetofverticescorrespondingtoenemystrongholds,andletV denotethesetofverticescorresponding
I R
totownswithremediationstations,withV ∩V = ∅. WeassumethatanyunitenteringatowninV willbecome
R I I
infectedwithmalware,andanyunitenteringatowninV willbecomeclean. Inaddition,weassumethatacleanunit
R
enteringatownwithatleastoneinfectedunitwillbecomeinfected,andalsothatacleanunittraversingaroadwith
Figure5: ModifiedMarkovchainforsimpleexamplescenario
Figure6: Agent-basedmodelforsimpleexamplescenario
atleastoneinfectedunittravelingintheoppositedirectionwillbecomeinfected. Thegoalistodeterminetheoptimal
setV ofsizek,givenV . ThemodifiedMarkovchainfortheexamplescenarioisillustratedinFigure5.
R I
Similarlytoabove,themovementofallunitscollectivelycanbecapturedbyasetofdifferentialequations,which,
given V and V , can be solved efficiently for the equilibrium fraction of units in each state (see Appendix A for
I R
details). Inthismodifiedmodel,however,wehaveawayofquantifyingtheeffectivenessofaproposedsolution: the
total fraction of infected units at equilibrium. The remaining challenge is in finding the set V that minimizes that
R
value.
Ifn,thenumberoftowns,andk,thedesirednumberofremediationstations,aresmall,thenanexhaustivesearch
maybefeasible.Otherwise,weproposetwoalgorithms:onewhichsimplyentailssamplingfromthespaceofpossible
solutionsandchoosingwhicheversolutiongivesthebestresult;andonewhichisbasedonmoresophisticatedrandom
samplingandMonteCarlomethods,describedinAlgorithm2.
Thedynamicalsystemsapproachaddressessomeofthemajorproblemswiththecentrality-basedapproach, viz.
consideringmultipletownssimultaneously,andexplicitlyrepresentingthepresenceofenemystrongholds.However,it
islessflexiblethanthecentrality-basedapproachinaccommodatingdifferentmobilitymodels;theMarkovpropertyis
fineformodelingarandomwalkontheroadnetwork,butcannoteasilyrepresentmulti-hoppathssuchastraversingthe
shortestpathbetweentwotowns.Inaddition,themodelmakesseveralsimplifyingassumptionsthatcouldcompromise
theaccuracyoftheresults.
Next,wepresentanapproachthatgivesgreaterflexibilityinmodelingandalsopermitsahigherdegreeofrealism.
2.4 Agent-basedModeling
In this approach, we develop an agent-based model to represent the movement of and interactions between tactical
units.Theagentsarethetacticalunits,eachrepresentedbyaUnitobject.TheenvironmentconsistsofTownobjects,
representedbycircularregions,andRoadobjects,eachconnectingtwoTowns.Townscanbeally-controlled,enemy-
controlled, or neutral. This approach can accommodate many different mobility models, including both the random
Algorithm2MonteCarloalgorithm
Input: AgraphGrepresentingtownsconnectedbyaroadnetwork,asubsetofverticesV ⊆V(G)correspondingto
I
enemystrongholds,afunctionf :2V(G)→RmappingvertexsubsetsV totheresultingfractionofinfectedunitsif
R
remediationzoneswereestablishedatthecorrespondingtowns,anintegersindicatinghowmanyrandomsamplesto
takeatthecorrespondingpointinthealgorithm,andanintegerk ≥1indicatingthenumberofremediationzonesfor
whichresourcesareavailable.
Output: AsubsetV∗ ⊆V(G)ofsizekcorrespondingtothetownsatwhichtoestablishremediationzones.
R
1. InitializeV(0) :=∅
R
2. InitializeV∗ :=∅
R
3. Initializef∗ :=0
4. For1≤i≤k:
• Forv ∈V(G)−V(i−1):
R
– InitializeFsum[v]=0
– InitializeFcount[v]=0
• for1≤j ≤s
– RandomlyselectasubsetV(cid:48) ⊆V(G)−V(i−1)ofsizek−(i−1)
R
– SetV(cid:48)(cid:48) :=V(i−1)∪V(cid:48)
R
– Forv ∈V(cid:48):
∗ UpdateFsum[v]:=Fsum[v]+f(V(cid:48)(cid:48))
∗ UpdateFcount[v]:=Fcount[v]+1
– Iff(V(cid:48)(cid:48))<f∗:
∗ SetV∗ :=V(cid:48)(cid:48)
R
∗ Setf∗ :=f(V(cid:48)(cid:48))
• Setv := min Fsum[v]
i Fcount[v]
v∈V∗−V(i−1)
R R
• SetV(i) :=V(i−1)∪{v }
R R i
5. ReturnV∗ =V(k) ={v :1≤i≤k}
R R i
walkandtherandomwaypointmodelsfortraversingtheroadnetwork. Anagent-basedmodelforasimpleexample
scenarioisillustratedinFigure6.
WhenaUnitisdeployedatorpassesthroughanenemy-controlledTown, wemaketheworst-caseassumption
thattheenemywillbeabletoinfectatleastoneofthesoldiers’devices,andthatrelativelysoonthereafterthemalware
willspreadtothewholeUnitasthesoldiersinteractwithoneanother. Inaddition,weassumethatiftwoUnitsare
deployedtothesameTownsimultaneously,orifoneUnitpassesthroughtheTownwheretheotherisdeployed,or
iftwoUnitspasseachotheronaRoad,therewillbeatleastsomecontactbetweentheUnits;therefore,ifoneof
themisinfected,theotherwillalsobecomeinfected.
Asbefore,ourgoalistodeterminethesetofverticesV atwhichtoplaceremediationzonessoastominimizethe
R
fractionofinfectedunits. Anobviouswaytoevaluateaproposedsolution,then,istorunthesimulationforaperiod
oftimeandthencounthowmanyoftheunitsareinfected. Becauseofrandomvariation,theresultshouldbeaveraged
over multiple trials. As with the dynamical systems approach, the remaining challenge is in finding the set V that
R
minimizesthatvalue. Forthis,weproposeusingeitherthesimplerandomsamplingmethodorthesameMonteCarlo
algorithmproposedabove, Algorithm2, substitutingtheresultsoftheagent-basedsimulationforthesolutiontothe
dynamicalsystemwhendefiningthefunctionf.
Figure7: Labeledscreenshotofagent-basedsimulationinRepastSimphony
The agent-based modeling approach has higher fidelity and expressiveness than the other approaches, but can
also be more computationally expensive. In the following section, we evaluate both the effectiveness and computa-
tionalefficiencyofthethreemethodsindeterminingtheplacementofremediationstationstobestlimitthespreadof
malware.
3 Evaluation
We now perform experiments to evaluate and compare the performance of the three approaches. Since the agent-
based model has the highest fidelity of the three approaches, we use it as an evaluative metric to compare different
recommended placement strategies. Given that, one might expect that the agent-based modeling approach would
trivially yield the best results. However, as we will observe, due to computational limitations this is not always the
case.
Beforeweproceedwiththeexperiments,weprovidedetailsofourimplementation.
3.1 ImplementationandExperimentalSetup
AllthreeoftheapproachesareimplementedinJava.Solvingsystemsofequationsforthedynamicalsystemsapproach
was done using the JAMA linear algebra package. Simulations of the agent-based model can be visualized using
RepastSimphony,aJava-basedagent-basedmodelingandsimulationenvironment. Experimentsareconductedonan
IntelCorei7processoroperatingat2.40GHzwith16GBofmemoryrunningWindows10.
Figure7givesascreenshotofanexamplerunoftheagent-basedsimulation. Theblackcirclesrepresentneutral
Towns, the red circles represent Towns under enemy control, and the green circles represent Towns under allied
control. Unitsaredepictedbyared‘X’wheninfectedandablack‘X’whenuninfected.
Fortheexperimentspresentedhere,weconsiderfivetacticalunitsoperatinginageographicalareaconsistingof
35townsconnectedbyaroadnetwork. Unitsmoveataspeedof10m/s,anddeploymentslast2hours. Wevarythe
numberofinfectedtownsandremediationzones. Simulationswererunfor10,000timesteps. Resultswereaveraged
over20independenttrials.
3.2 Results
The results of our experiments are shown in Tables 1 (Random Walk mobility model) and 2 (Random Waypoint
mobility model). For a baseline, we also record the average fraction of infected units when remediation zones are
chosenuniformlyatrandom.
The best performers under the Random Walk mobility model were the Iterative PageRank Centrality method
and the Dynamical Systems methods (either using simple random sampling or the more sophisticated Monte Carlo
Table 1: Experimental results under the Random Walk mobility model, in terms of the fraction of units infected,
averagedover20trials
#Inf #Rmd Betweenness PageRank DynamSys Agent-based Uniform
Zones Zones Top-k Iter Top-k Iter Basic MC Basic MC Random
5 0 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000
5 1 0.844 0.834 0.861 0.844 0.795 0.795 0.870 0.870 0.862
5 3 0.701 0.710 0.658 0.582 0.572 0.573 0.675 0.640 0.716
5 5 0.615 0.618 0.514 0.438 0.442 0.424 0.541 0.515 0.594
3 5 0.480 0.529 0.407 0.295 0.336 0.274 0.445 0.393 0.493
1 5 0.199 0.248 0.186 0.113 0.128 0.101 0.197 0.113 0.267
0 5 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000
Table2: ExperimentalresultsundertheRandomWaypointmobilitymodel,intermsofthefractionofunitsinfected,
averagedover20trials
#Inf #Rmd Betweenness PageRank DynamSys Agent-based Uniform
Zones Zones Top-k Iter Top-k Iter Basic MC Basic MC Random
5 0 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000
5 1 0.743 0.793 0.852 0.743 0.779 0.779 0.878 0.878 0.940
5 3 0.543 0.673 0.640 0.446 0.526 0.556 0.717 0.621 0.758
5 5 0.461 0.581 0.520 0.345 0.403 0.395 0.561 0.489 0.624
3 5 0.321 0.474 0.385 0.203 0.289 0.238 0.373 0.312 0.455
1 5 0.112 0.252 0.160 0.068 0.122 0.096 0.148 0.088 0.214
0 5 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000
Table3: Runtimesforthedifferentapproaches,inseconds,averagedover20trials
Betweenness PageRank DynamSys Agent-based Uniform
Top-k Iter Top-k Iter Basic MC Basic MC Random
Runtimes 0.209 0.209 0.209 0.208 0.414 0.418 1.247 1.040 1.247
algorithm). Theothermethodsperformedsignificantlyworsethanthose,andcomparablytooneanother,sometimes
notevenmatchingtheresultsoftheuniformrandombaseline.
UnderthemorerealisticRandomWaypointmobilitymodel,IterativePageRankwastheclearwinner,performing
even better than under Random Walk. This was surprising, and ran counter to our intuition that PageRank would
perform best under Random Walk because it has a natural correspondence to walks on graphs. Similarly, we were
surprised that Betweenness centrality did not perform better under the Random Waypoint model, given its natural
correspondencetographpaths. WiththeexceptionoftheIterativeBetweennessmethod, allmethodsout-performed
thebaseline.
WenotethatweconfiguredtheABMmethodtousefewerMCsamplesthantheDynamicalSystemsmethod(10
instead of 100) to keep its runtime comparable, since it does an evaluation over 10 sample trials for each candidate
strategyratherthanjustsolvingasystemofequationsonce. Wesuspectthatthesmallsamplesizeresultedinahigh
varianceacrosstrials,whichcouldexplainwhytheABMapproachperformedsopoorly.
RuntimesareshowninTable3. Forthissettingoftheparameters,thecentralityalgorithmseachraninabout12
seconds, Dynamical Systems ran in about 25 seconds, ABM with MC in about 60 seconds, and ABM with random
samplinginabout75seconds.
Approach Pros Cons
doesnotcapture
canbeefficient,
traveltimes,
choiceofmetric
cannotspecify
Centrality canaccommodate
enemytowns,not
metrics differentcontexts
goodfor
ormobility
multi-site
patterns
selection
assumesRandom
efficient,goodfor Walkmobility
Dynamical
multi-site patternbecause
systems
selection ofMarkov
property
veryflexibleand
expressive,most
Agent-based notasefficientas
realistic,goodfor
modeling otherapproaches
multi-site
selection
Table4: Prosandconsofthethreeapproaches
4 Conclusions
Wehaveproposedthenotionof“keycyber-physicalterrain”todescribetheriskposedbyshort-rangewirelessattacks
underthedynamicconnectivitygraphsoffieldoperations: specificphysicallocationsatwhichmobiledevicescanbe
examinedandremediatedtominimizetheabilityofanadversarytomaintainapresenceonthemobilenetwork. As
the exact solution to this problem is computationally intractable, we have also proposed three approximate methods
ofsolvingtheassociatedminimizationproblem–centralitymetrics,dynamicalsystems,andagent-basedmodeling–
undertwodifferentmodelsofunitmobility. SomeoftheirprosandconsarelistedinTable4.
Our results suggest that the problem of malware propagating through short-range wireless communications is
potentiallyquitesignificant,withahighprevalenceofmalwarepersistingonthenetwork,evenwhentheremediation
zones are placed strategically in response to the locations of the infection zones. It is also worth noting that simple
algorithms based on network centrality metrics, in particular PageRank centrality, can match and even outperform
more complex approximations, even under the more realistic Random Waypoint mobility model. In either case, we
obtain solutions reasonably quickly, with average runtimes of about 1 minute even for our most computationally
intensive approach. Wenote, however, thatthe variance forthe agent-based modelingis relatively high, as the total
numberofpotentialtrajectoriesthroughthecombinatorialnumberofremediationzonesisprohibitivelylarge;results
could be improved by increasing sample sizes in the Monte Carlo algorithm, at the cost of longer runtimes, which
wouldbefurtherexacerbatedastheproblemscalesup. Methodstomitigatethisvariancewillbeexploredinfuture
work.
Ourcurrentresultsshowthatbothourcentralityanddynamicalsystemsmethodscanapproachtheaccuracyofthe
morecomputationallyintensiveagent-basedmodelingapproachunderthemobilitymodelsused. Ontheotherhand,
theagent-basedapproachprovidesmuchgreaterflexibilityforrepresentingmoresophisticatedandrealisticmovement
patternsandhigher-fidelitymodels. Forexample,insteadofrandomdeploymentsandshortest-pathtraversals,simula-
tionscouldbeperformedusingreal-worldmapsandscenarios,andpathsmayintentionallyavoidlocationsofenemy
strongholds. An alternative problem formulation could allow strategies to simultaneously define the traversal paths
betweenpairsoftownsaswellasthelocationsoftheremediationzones. Thiswillbeexploredinfuturework,aswell
asextensionstoourtacticalmodelinwhichenemyinfectionregionsaswellasremediationzonesmaybedynamicor
increaseinnumber.